A LoSS Based On-line Detection of Abnormal Traffic Using Dynamic Detection Threshold

摘要

Abnormal traffic detection is a difficult problem in network management and network security. This paper proposed an abnormal traffic detection method based on LoSS (loss of self-similarity) through comparing the difference of Hurst parameter distribution under the network normal and abnormal traffic time series conditions. This method adopted wavelet analysis to estimate the Hurst parameter of network traffic in large time-scale, and the detection threshold could self-adjusted according to the extent of network traffic self-similarity under normal conditions. The test results on data set from Lincoln Lab of MIT demonstrate that the new detection method has the characteristics of dynamic self-adaptive and higher detection rate, and the detection speed is also improved by one time segment.